{"id":28035463,"url":"https://github.com/lfreleng-actions/pinned-versions-action","last_synced_at":"2025-05-11T12:01:53.924Z","repository":{"id":291672557,"uuid":"975480019","full_name":"lfreleng-actions/pinned-versions-action","owner":"lfreleng-actions","description":"Ensures workflows are pinned to SHA commit values","archived":false,"fork":false,"pushed_at":"2025-05-05T23:30:30.000Z","size":11,"stargazers_count":0,"open_issues_count":1,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-05-06T00:32:34.991Z","etag":null,"topics":["actions","audit","auditing","github-actions","github-workflows","security","validation"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lfreleng-actions.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-04-30T11:36:39.000Z","updated_at":"2025-05-05T23:30:31.000Z","dependencies_parsed_at":"2025-05-06T00:33:01.998Z","dependency_job_id":"10c509f2-2138-4668-bc64-52671e556458","html_url":"https://github.com/lfreleng-actions/pinned-versions-action","commit_stats":null,"previous_names":["lfreleng-actions/pinned-versions-action"],"tags_count":0,"template":false,"template_full_name":"lfreleng-actions/actions-template","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lfreleng-actions%2Fpinned-versions-action","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lfreleng-actions%2Fpinned-versions-action/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lfreleng-actions%2Fpinned-versions-action/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lfreleng-actions%2Fpinned-versions-action/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lfreleng-actions","download_url":"https://codeload.github.com/lfreleng-actions/pinned-versions-action/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253561198,"owners_count":21927787,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["actions","audit","auditing","github-actions","github-workflows","security","validation"],"created_at":"2025-05-11T12:01:06.222Z","updated_at":"2025-05-11T12:01:53.880Z","avatar_url":"https://github.com/lfreleng-actions.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003c!--\n# SPDX-License-Identifier: Apache-2.0\n# SPDX-FileCopyrightText: 2025 The Linux Foundation\n--\u003e\n\n# 📌 Pinned Versions Action\n\nVerifies action/workflow calls use SHA commit values.\n\n## pinned-versions-action\n\n## Recommended Event Triggers\n\n```yaml\non:\n    workflow_dispatch:\n    pull_request:\n        branches:\n            - main\n            - master\n        paths: [\".github/**\"]\n```\n\n## Usage Example\n\n\u003c!-- markdownlint-disable MD013 --\u003e\n\n```yaml\njobs:\n  check-actions:\n    runs-on: ubuntu-24.04\n    permissions:\n      contents: read\n    steps:\n      - name: 'Check Pinned Versions'\n        uses: lfreleng-actions/pinned-versions-action@main\n```\n\n\u003c!-- markdownlint-enable MD013 --\u003e\n\n## Inputs\n\n\u003c!-- markdownlint-disable MD013 --\u003e\n\n| Variable Name | Required | Default                         | Description                                      |\n| ------------- | -------- | ------------------------------- | ------------------------------------------------ |\n| path_prefix   | False    | '.' (current working directory) | Directory location containing project code       |\n| no_checkout   | False    | false                           | Don't perform a checkout of the local repository |\n\n\u003c!-- markdownlint-enable MD013 --\u003e\n\n## Behaviour\n\n### Pull Requests\n\nWhen triggered against a pull request, will audit the change content for any\ncalls to GitHub actions/workflows that are not pinned to a SHA commit value.\nThis scans files changed in the pull request, and will NOT block merges\nwhere GitHub actions elsewhere in the repository do not use SHA/commit values.\n\n### Manual Invocation\n\nOperates differently when explicitly called using \"workflow_dispatch\" trigger.\nWill scan the entire repository for action/workflow calls and report results\nfor all GitHub actions/workflows found.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flfreleng-actions%2Fpinned-versions-action","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flfreleng-actions%2Fpinned-versions-action","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flfreleng-actions%2Fpinned-versions-action/lists"}